@posthog/mcp 0.10.7 → 0.10.8

package/src/extensions/conversation-id.ts

@@ -11,7 +11,6 @@ import {
 } from './analytics-parameters'
 import { DEFAULT_CONVERSATION_ID_DESCRIPTION } from './constants'
 import { log, type LoggerFn } from './logger'
-import { GET_MORE_TOOLS_NAME } from './tools'
 
 export const CONVERSATION_ID_PARAM_NAME = 'conversation_id'
 
@@ -70,60 +69,83 @@ export function addConversationIdToTool<TTool extends ConversationIdInjectableTo
   return modifiedTool
 }
 
+/**
+ * Injects `conversation_id` across a tool listing, including the virtual
+ * `get_more_tools` tool. Its calls publish `$mcp_missing_capability`, and a
+ * capability gap is only meaningful next to the work that hit it — so it belongs
+ * in the same session as the surrounding tool calls.
+ */
 export function addConversationIdToTools<TTool extends ConversationIdInjectableTool>(
   tools: TTool[],
-  missingCapabilityToolName: string = GET_MORE_TOOLS_NAME,
-  skipMissingCapabilityTool = true,
   logger: LoggerFn = log
 ): TTool[] {
-  return tools.map((tool) => {
-    if (skipMissingCapabilityTool && tool.name === missingCapabilityToolName) {
-      return tool
-    }
-    return addConversationIdToTool(tool, logger)
-  })
+  return tools.map((tool) => addConversationIdToTool(tool, logger))
 }
 
+/**
+ * The shape of every id we mint: a uuidv7. Used to tell an echo of our own handle
+ * from a value the agent made up.
+ */
+const MINTED_CONVERSATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+
 export type ConversationIdResolution =
   | { minted: false; conversationId: string | undefined }
   | { minted: true; conversationId: string }
 
 /**
  * Decides which conversation_id to use for a tool call:
- *   - disabled or get_more_tools → none
- *   - agent supplied a value → use it
- *   - agent omitted → mint a UUID
+ *   - disabled → none
+ *   - agent echoed a handle we could have minted → use it
+ *   - anything else → mint a fresh one
+ *
+ * The shape check matters because this value becomes `$session_id`, and the
+ * derivation is deterministic so that two pods agree — which also means two
+ * *callers* sending the same string land in the same session. The strings agents
+ * invent are not random (`conv-1`, `1`, `session`), so trusting them verbatim
+ * would silently merge unrelated conversations, potentially across users.
+ *
+ * A compliant agent echoes the uuidv7 we minted and is unaffected. Anything else
+ * is treated exactly as if the handle were absent: mint, and prompt back. Shape
+ * rather than a registry of issued ids, because a per-request server has no
+ * memory of what it minted.
+ *
+ * This narrows the problem, it does not prove provenance: a caller supplying a
+ * well-formed uuidv7 is trusted, so two that pick the *same* one still merge. That
+ * residue is far smaller than the case it replaces — an agent ignoring the
+ * parameter description reaches for `conv-1` or `1`, not a conforming uuidv7 — and
+ * closing it needs a signed handle, i.e. a secret shared by every pod. Worth doing
+ * if this ever anchors something security-bearing; `$session_id` is an analytics
+ * grouping key, so it does not today.
  */
-export function resolveConversationId(
-  enabled: boolean,
-  args: unknown,
-  toolName: string | undefined,
-  missingCapabilityToolName: string = GET_MORE_TOOLS_NAME
-): ConversationIdResolution {
-  if (!enabled || toolName === missingCapabilityToolName) {
+export function resolveConversationId(enabled: boolean, args: unknown): ConversationIdResolution {
+  if (!enabled) {
     return { minted: false, conversationId: undefined }
   }
   const supplied = extractConversationId(args)
-  if (supplied) {
-    return { minted: false, conversationId: supplied }
+  if (supplied && MINTED_CONVERSATION_ID.test(supplied)) {
+    // Lowercased because the shape test is case-insensitive but the hash behind
+    // `$session_id` is not. Some hosts normalise uuids to uppercase, and an
+    // uppercased echo of our own handle would otherwise clear the gate and then
+    // land in a different session than the call that minted it.
+    return { minted: false, conversationId: supplied.toLowerCase() }
   }
   return { minted: true, conversationId: uuidv7() }
 }
 
 /**
- * Predicate matching the same eligibility checks injectConversationIdPromptBack uses,
- * exposed so callers can pre-decide whether the prompt-back will actually land
- * (and clear event.conversationId if not, to avoid orphan ids in analytics).
+ * Whether the prompt-back can ride this result's `content`. The only requirement
+ * is an array to append to.
+ *
+ * Errored results included on purpose. A tool that fails on the first call of a
+ * conversation is exactly when the agent needs the session handle: without it the
+ * retry starts a fresh conversation, so the failure and its fix land in different
+ * sessions.
  */
 export function canInjectConversationIdPromptBack(result: unknown): boolean {
   if (!(result && typeof result === 'object')) {
     return false
   }
-  const resultObj = result as { content?: unknown; isError?: unknown }
-  if (resultObj.isError === true) {
-    return false
-  }
-  return Array.isArray(resultObj.content)
+  return Array.isArray((result as { content?: unknown }).content)
 }
 
 export function extractConversationId(args: unknown): string | undefined {

package/src/extensions/instrument-highlevel.ts

@@ -262,7 +262,9 @@ async function handleToolCallRequest(
     request,
     extra,
     execute: (downstreamRequest) => originalCallToolHandler(downstreamRequest as MCPRequest, extra),
-    parameterOwnership: registeredTool ? getAnalyticsParameterOwnership(registeredTool.inputSchema) : undefined,
+    parameterOwnership: registeredTool
+      ? getAnalyticsParameterOwnership(registeredTool.inputSchema, registeredTool.outputSchema)
+      : undefined,
     takeCapturedError: () => {
       const captured = extra?.__mcp_analytics_error
       if (extra) {

package/src/extensions/instrumentation.ts

@@ -24,6 +24,7 @@ import {
   resolveConversationId,
 } from './conversation-id'
 import { stampMetaClientInfo } from './client-identity'
+import { addInstructionsToOutputSchemas, mirrorInstructionsIntoStructuredContent } from './output-instructions'
 import { captureEvent } from './capture'
 import { MCPAnalyticsEventType } from './event-types'
 import { captureException } from './exceptions'
@@ -106,14 +107,7 @@ export async function captureToolCall(params: TraceToolCallParams): Promise<unkn
     parameterOwnership,
     resolvedEventType === MCPAnalyticsEventType.mcpMissingCapability
   )
-  const conversation = resolveConversationId(
-    ownership.conversationId,
-    request.params?.arguments,
-    request.params?.name,
-    resolvedEventType === MCPAnalyticsEventType.mcpMissingCapability
-      ? resolveMissingCapabilityToolName(data.options)
-      : ''
-  )
+  const conversation = resolveConversationId(ownership.conversationId, request.params?.arguments)
   const downstreamRequest = cloneRequestWithoutOwnedAnalyticsArguments(request, ownership)
 
   // Prepare the event in isolation: if identity/metadata/intent resolution
@@ -142,7 +136,7 @@ export async function captureToolCall(params: TraceToolCallParams): Promise<unkn
     throw error
   }
 
-  const finalResult = applyConversationPromptBack(preparedEvent?.event ?? null, result, conversation)
+  const finalResult = applyConversationInstructions(preparedEvent?.event ?? null, result, conversation, ownership)
   publishSuccessfulToolEvent(server, preparedEvent, finalResult, startTime, data.logger, takeCapturedError)
   return finalResult
 }
@@ -158,11 +152,28 @@ function getActiveAnalyticsParameterOwnership(
   override: AnalyticsParameterOwnership | undefined,
   isMissingCapabilityTool: boolean
 ): AnalyticsParameterOwnership {
-  const ownership = override ?? (toolName ? data.toolAnalyticsParameterOwnership.get(toolName) : undefined)
+  const listed = toolName ? data.toolAnalyticsParameterOwnership.get(toolName) : undefined
+  const ownership = override ?? listed
   return {
     context: !isMissingCapabilityTool && isContextEnabled(data.options.context) && ownership?.context === true,
-    conversationId:
-      !isMissingCapabilityTool && data.options.enableConversationId === true && ownership?.conversationId === true,
+    conversationId: data.options.enableConversationId === true && ownership?.conversationId === true,
+    // Deliberately read off `listed`, never the override. This asks whether
+    // `tools/list` actually declared `_mcp_instructions`, and only the advertised
+    // JSON Schema can answer it — an override is built from the live registry,
+    // which on the high-level path holds Zod.
+    //
+    // The cache is per-instance, so this is not merely "before the first
+    // `tools/list`": an instance that never serves a listing never writes the
+    // mirror at all. That is the per-request server pattern — `tools/list` lands
+    // on one instance, `tools/call` on a cold one — where the handle falls back
+    // to the `content` block and a structuredContent-only client misses it.
+    //
+    // Failing closed is deliberate. Writing a key the advertised schema did not
+    // declare fails the *entire* tool result under `additionalProperties: false`,
+    // so guessing costs the caller their result, while not guessing costs us one
+    // delivery channel. The fix is a process-scoped ownership cache, so a listing
+    // served by any instance answers for the rest — not a per-call guess.
+    outputInstructions: data.options.enableConversationId === true && listed?.outputInstructions === true,
   }
 }
 
@@ -196,11 +207,19 @@ async function prepareToolCallEvent(
   eventType: MCPAnalyticsEventType
 ): Promise<PreparedToolEvent | null> {
   try {
-    const sessionId = getSessionId(server, extra)
+    const sessionId = getSessionId(server, extra, conversation.conversationId)
     // Snapshot token/client/protocol metadata synchronously, before identify or
     // metadata callbacks can yield and let another request replace shared state.
     const sessionInfo = getSessionInfo(server, data, sessionId)
-    const identity = await handleIdentify(server, data, sessionId, request, sessionInfo, extra)
+    const identity = await handleIdentify(
+      server,
+      data,
+      sessionId,
+      request,
+      sessionInfo,
+      extra,
+      !!conversation.conversationId
+    )
     const requestAttribution = withIdentity(sessionInfo, identity)
 
     const toolName = request.params?.name
@@ -231,25 +250,51 @@ async function prepareToolCallEvent(
 }
 
 /**
- * When we minted a conversation id, append the prompt-back so the agent echoes
- * it on subsequent calls. If the result can't carry it, clear the id off the
- * event so analytics doesn't show an orphan the agent never received.
+ * Delivers the conversation session handle back to the agent, over both channels a tool
+ * result has:
+ *
+ * - `structuredContent`, on *every* response for a tool whose output schema we
+ *   declared the key on. Clients that read structured results never see the text
+ *   block, and re-sending it each time lets an agent that dropped the session handle read
+ *   it back.
+ * - `content`, as a text block, only on the response that minted the session handle.
+ *   Repeating it every call would put a `[SERVER]:` line in front of the user on
+ *   every single tool result.
+ *
+ * If neither channel could carry a session handle we minted, the agent never received it,
+ * so clear it off the event rather than showing analytics an id nobody has.
  */
-function applyConversationPromptBack(
+function applyConversationInstructions(
   event: McpEvent | null,
   result: unknown,
-  conversation: ConversationIdResolution
+  conversation: ConversationIdResolution,
+  ownership: AnalyticsParameterOwnership
 ): unknown {
-  if (!conversation.minted) {
+  const conversationId = conversation.conversationId
+  if (!conversationId) {
     return result
   }
-  if (canInjectConversationIdPromptBack(result)) {
-    return injectConversationIdPromptBack(result, conversation.conversationId)
+
+  let updated = result
+  let delivered = false
+
+  if (ownership.outputInstructions) {
+    const mirrored = mirrorInstructionsIntoStructuredContent(updated, conversationId)
+    delivered = mirrored !== updated
+    updated = mirrored
+  }
+
+  if (conversation.minted && canInjectConversationIdPromptBack(updated)) {
+    updated = injectConversationIdPromptBack(updated, conversationId)
+    delivered = true
   }
-  if (event) {
+
+  // Only a minted session handle can be lost this way — one the agent supplied, it has.
+  if (!delivered && conversation.minted && event) {
     event.conversationId = undefined
   }
-  return result
+
+  return updated
 }
 
 function publishSuccessfulToolEvent(
@@ -478,7 +523,7 @@ function cacheToolAnalyticsParameterOwnership(
   // Merge pages and concurrent enumerations; repeated tool names overwrite stale schemas.
   for (const tool of tools) {
     if (tool?.name) {
-      cache.set(tool.name, getAnalyticsParameterOwnership(tool.inputSchema))
+      cache.set(tool.name, getAnalyticsParameterOwnership(tool.inputSchema, tool.outputSchema))
     }
   }
 }
@@ -515,7 +560,6 @@ async function getTracedToolsList(
 
     if (data) {
       const missingToolName = resolveMissingCapabilityToolName(data.options)
-      let injectedMissingCapabilityTool = false
       if (data.options.reportMissing) {
         const alreadyPresent = tools.some((tool) => tool?.name === missingToolName)
         if (alreadyPresent) {
@@ -523,13 +567,17 @@ async function getTracedToolsList(
             `Warning: Cannot inject missing-capability tool "${missingToolName}" because a real tool already uses that name. The real tool will not be intercepted.`
           )
         } else {
-          tools.push(getReportMissingToolDescriptor(missingToolName))
-          injectedMissingCapabilityTool = true
+          const virtualTool = getReportMissingToolDescriptor(missingToolName)
+          tools.push(virtualTool)
+          // Cached separately because the virtual tool is added after the listing
+          // was cached, and its calls need ownership like any other tool's.
+          cacheToolAnalyticsParameterOwnership(data.toolAnalyticsParameterOwnership, [virtualTool])
         }
       }
 
       if (data.options.enableConversationId) {
-        tools = addConversationIdToTools(tools, missingToolName, injectedMissingCapabilityTool, data.logger)
+        tools = addConversationIdToTools(tools, data.logger)
+        tools = addInstructionsToOutputSchemas(tools, data.logger)
       }
     }
 

package/src/extensions/internal.ts

@@ -130,7 +130,14 @@ export async function handleIdentify(
   sessionId: string,
   request: MCPRequestLike,
   requestAttribution: SessionInfo,
-  extra?: CompatibleRequestHandlerExtra
+  extra?: CompatibleRequestHandlerExtra,
+  /**
+   * True when this session id came from an agent-carried `conversation_id`
+   * rather than the transport. Such a session is brand new and was never
+   * announced at `initialize`, whatever `data.sessionSource` still says about
+   * the connection.
+   */
+  sessionFromConversation = false
 ): Promise<UserIdentity | undefined> {
   const identityBeforeRequest = data.identifiedSessions.get(sessionId)
   const sessionSourceBeforeIdentify = data.sessionSource
@@ -166,7 +173,8 @@ export async function handleIdentify(
       // announced); revisit with the stateless-by-default rework.
       const changed = previousIdentity !== undefined && !areIdentitiesEqual(previousIdentity, mergedIdentity)
       const firstSeen = previousIdentity === undefined
-      const announcedAtInitialize = sessionSourceBeforeIdentify === 'token' && request.method !== 'initialize'
+      const announcedAtInitialize =
+        !sessionFromConversation && sessionSourceBeforeIdentify === 'token' && request.method !== 'initialize'
       const shouldPublish = changed || (firstSeen && !announcedAtInitialize)
 
       data.identifiedSessions.set(sessionId, mergedIdentity)

package/src/extensions/output-instructions.ts

@@ -0,0 +1,231 @@
+import type { LoggerFn } from './logger'
+import { log } from './logger'
+import type { AnalyticsInjectableJsonSchema } from './analytics-parameters'
+
+/**
+ * The `conversation_id` session handle reaches the agent as a text block appended to the
+ * tool result. That block is invisible to any client that reads
+ * `structuredContent` instead of `content` — which is what clients do whenever a
+ * tool declares an `outputSchema`. Measured against Claude Code, correlation for
+ * such tools drops to zero.
+ *
+ * The fix is to mirror the session handle into `structuredContent` as well, which this
+ * module does in two halves that must stay in that order:
+ *
+ *   1. declare `_mcp_instructions` on the tool's advertised `outputSchema`
+ *   2. write it into the result's `structuredContent`
+ *
+ * The declaration is what makes the write safe. The MCP client ajv-validates
+ * `structuredContent` against the schema from `tools/list`, and
+ * `zod-to-json-schema` emits `additionalProperties: false` for a plain
+ * `z.object`, so an undeclared key is not ignored — it fails the entire tool
+ * result. Only tools that got the declaration are ever written to.
+ */
+export const MCP_INSTRUCTIONS_KEY = '_mcp_instructions'
+
+const INSTRUCTIONS_FIELD_DESCRIPTION =
+  'Server-issued handles for this conversation, and what to do with them. Read and follow.'
+
+const CONVERSATION_ID_FIELD_DESCRIPTION =
+  'Echo this exact value as the conversation_id argument on every subsequent tool call.'
+
+export interface OutputInstructionsInjectableTool {
+  name?: string
+  outputSchema?: unknown
+  [key: string]: unknown
+}
+
+/**
+ * True when we can safely declare {@link MCP_INSTRUCTIONS_KEY} on this tool's
+ * advertised output schema.
+ *
+ * Requires a plain-object schema we can extend. A tool with no `outputSchema`
+ * has nothing to mirror into and keeps working through `content`; a composed
+ * schema (`oneOf`/`allOf`/`anyOf`/`$ref`) has no single `properties` bag to add
+ * to. Both stay content-only, matching the policy on the input side.
+ */
+export function canDeclareOutputInstructions(outputSchema: unknown): boolean {
+  if (!outputSchema || typeof outputSchema !== 'object') {
+    return false
+  }
+
+  // Only the JSON Schema a tool advertises can answer this. A Zod schema or raw
+  // shape — what the high-level registry stores — has no `properties` bag, so
+  // every check below would pass vacuously and report `true` for a tool whose
+  // schema we actually skipped. Refuse rather than guess: callers holding a Zod
+  // value must read the recorded answer off the ownership registry instead.
+  if (isSchemaObjectLike(outputSchema)) {
+    return false
+  }
+
+  const schema = outputSchema as AnalyticsInjectableJsonSchema
+  if (schema.$ref || schema.oneOf || schema.allOf || schema.anyOf) {
+    return false
+  }
+
+  // `properties` must be a plain object if it is present at all. A tool that
+  // advertises something else is malformed, and harmlessly so until we try to
+  // declare into it — assigning a key to a boolean throws, and that throw
+  // surfaces inside the `tools/list` wrapper, failing the entire listing over a
+  // schema we only wanted to annotate.
+  const { properties } = schema
+  if (
+    properties !== undefined &&
+    (typeof properties !== 'object' || properties === null || Array.isArray(properties))
+  ) {
+    return false
+  }
+  return !properties || !Object.prototype.hasOwnProperty.call(properties, MCP_INSTRUCTIONS_KEY)
+}
+
+/** A single Zod schema — the internals every version brands its instances with. */
+function isZodLike(entry: unknown): boolean {
+  return !!entry && typeof entry === 'object' && ('_def' in entry || '_zod' in entry || '~standard' in entry)
+}
+
+/**
+ * Whether this is a JSON Schema, judged on the *value* of each marker rather
+ * than the key alone — a raw Zod shape is free to name a field `type` or
+ * `properties`, but its values are Zod schemas, not a string and a property bag.
+ */
+function looksLikeJsonSchema(candidate: Record<string, unknown>): boolean {
+  if (typeof candidate.type === 'string' || typeof candidate.$ref === 'string') {
+    return true
+  }
+  if (Array.isArray(candidate.oneOf) || Array.isArray(candidate.allOf) || Array.isArray(candidate.anyOf)) {
+    return true
+  }
+  const { properties } = candidate
+  return !!properties && typeof properties === 'object' && !isZodLike(properties)
+}
+
+/** A Zod schema, or a raw shape whose values are Zod schemas. */
+function isSchemaObjectLike(value: unknown): boolean {
+  const candidate = value as Record<string, unknown>
+  if (isZodLike(candidate)) {
+    return true
+  }
+
+  // Settle "is this a JSON Schema" before scanning the values, because a schema
+  // may legitimately declare a property named `_def` — and the scan below would
+  // read that property's schema object as a Zod value and skip a tool we could
+  // have annotated perfectly well.
+  if (looksLikeJsonSchema(candidate)) {
+    return false
+  }
+  return Object.values(candidate).some(isZodLike)
+}
+
+/**
+ * Returns a copy of the tool with an optional {@link MCP_INSTRUCTIONS_KEY}
+ * property added to its output schema, or the tool untouched when it has no
+ * output schema to extend.
+ *
+ * The property is never added to `required` — a result without it must stay
+ * valid, since every tool result predating this change lacks it.
+ */
+export function addInstructionsToOutputSchema<TTool extends OutputInstructionsInjectableTool>(
+  tool: TTool,
+  logger: LoggerFn = log
+): TTool {
+  const toolName = tool.name || 'unknown'
+  const original = tool.outputSchema
+
+  // No output schema means the client reads `content`, where the session handle already
+  // rides. Nothing to declare, and nothing broken.
+  if (!original || typeof original !== 'object') {
+    return tool
+  }
+
+  if (!canDeclareOutputInstructions(original)) {
+    const schema = original as AnalyticsInjectableJsonSchema
+    if (schema.properties && Object.prototype.hasOwnProperty.call(schema.properties, MCP_INSTRUCTIONS_KEY)) {
+      logger(
+        `WARN: Tool "${toolName}" already declares '${MCP_INSTRUCTIONS_KEY}' in its output schema. Leaving it alone.`
+      )
+    } else {
+      logger(
+        `WARN: Tool "${toolName}" has a complex output schema (oneOf/allOf/anyOf/$ref). Skipping '${MCP_INSTRUCTIONS_KEY}' declaration; its session handle stays content-only.`
+      )
+    }
+    return tool
+  }
+
+  const modifiedTool = { ...tool }
+  // Deep copy: the server may reuse or freeze the schema object it handed us.
+  const outputSchema = JSON.parse(JSON.stringify(original)) as AnalyticsInjectableJsonSchema
+
+  if (!outputSchema.properties) {
+    outputSchema.properties = {}
+  }
+
+  outputSchema.properties[MCP_INSTRUCTIONS_KEY] = {
+    type: 'object',
+    description: INSTRUCTIONS_FIELD_DESCRIPTION,
+    properties: {
+      conversation_id: {
+        type: 'string',
+        description: CONVERSATION_ID_FIELD_DESCRIPTION,
+      },
+      instructions: { type: 'string' },
+    },
+  }
+
+  modifiedTool.outputSchema = outputSchema
+  return modifiedTool
+}
+
+/**
+ * Declares {@link MCP_INSTRUCTIONS_KEY} across a tool listing. Tools without an
+ * output schema, and tools whose schema we cannot extend, pass through unchanged.
+ */
+export function addInstructionsToOutputSchemas<TTool extends OutputInstructionsInjectableTool>(
+  tools: TTool[],
+  logger: LoggerFn = log
+): TTool[] {
+  return tools.map((tool) => addInstructionsToOutputSchema(tool, logger))
+}
+
+export interface ConversationInstructions {
+  conversation_id: string
+  instructions: string
+}
+
+const ECHO_INSTRUCTION = 'Send this conversation_id as an argument on every subsequent tool call in this conversation.'
+
+/** The payload mirrored into `structuredContent` for a tool we declared the key on. */
+export function buildConversationInstructions(conversationId: string): ConversationInstructions {
+  return { conversation_id: conversationId, instructions: ECHO_INSTRUCTION }
+}
+
+/**
+ * Adds {@link MCP_INSTRUCTIONS_KEY} to a result's `structuredContent`, which is
+ * where clients look once a tool declares an `outputSchema` — the `content` text
+ * block carrying the session handle is invisible to them.
+ *
+ * Unlike the text block, this rides *every* response rather than only the one
+ * that minted the session handle, so an agent that drops it can read it back.
+ *
+ * Returns the result untouched when there is no plain-object `structuredContent`
+ * to extend, or when the tool already produced its own key — customer data wins.
+ * Never mutates the input.
+ */
+export function mirrorInstructionsIntoStructuredContent(result: unknown, conversationId: string): unknown {
+  if (!result || typeof result !== 'object') {
+    return result
+  }
+  const structuredContent = (result as { structuredContent?: unknown }).structuredContent
+  if (!structuredContent || typeof structuredContent !== 'object' || Array.isArray(structuredContent)) {
+    return result
+  }
+  if (Object.prototype.hasOwnProperty.call(structuredContent, MCP_INSTRUCTIONS_KEY)) {
+    return result
+  }
+  return {
+    ...result,
+    structuredContent: {
+      ...structuredContent,
+      [MCP_INSTRUCTIONS_KEY]: buildConversationInstructions(conversationId),
+    },
+  }
+}